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Statement 01/2022 on the announcement of an agreement 





in principle on a new Trans-Atlantic Data Privacy 
Framework 


Adopted on 6 April 2022 


The European Data Protection Board has adopted the following statement: 


The EDPB welcomes the announcement of a political agreement in principle between the European 
Commission and the United States on 25 March on a new Trans-Atlantic Data Privacy Framework. This 
announcement is made at a time where transfers from the European Economic Area to the U.S. face 
significant challenges. 


The commitment of the U.S. highest authorities to establish ‘unprecedented’ measures to protect the 
privacy and personal data of individuals in the European Economic Area (EEA individuals) when their 
data are transferred to the U.S. is a positive first step in the right direction. 


The EDPB will examine how this political agreement translates into concrete legal proposals to address 
the concerns raised by the Court of Justice of the European Union (CJEU) in order to provide legal 
certainty to EEA individuals and exporters of data. 


At this stage, this announcement does not constitute a legal framework on which data exporters can 
base their data transfers to the United States. Data exporters must therefore continue taking the 
actions required to comply with the case law of the CJEU, and in particular its Schrems II decision of 
16 July 2020. 


The GDPR requires that the Commission seeks an opinion of the EDPB before adopting a possible new 
adequacy decision recognising as satisfactory the level of data protection guaranteed by the U.S. 
authorities. 


The EDPB looks forward to assessing carefully the improvements that a new Trans-Atlantic Data 
Privacy Framework may bring in the light of EU law, the case-law of the CJEU and the 
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recommendations the EDPB made on that basis. The EDPB will prepare its opinion when it receives 
from the European Commission all supporting documents. 


In particular, the EDPB will analyse in detail how these reforms ensure that the collection of personal 
data for national security purposes is limited to what is strictly necessary and proportionate. 


The EDPB will also examine to what extent the announced independent redress mechanism respects 
the EEA individuals’ right to an effective remedy and to a fair trial. In particular, the EDPB will look at 
whether any new authority part of this mechanism has access to relevant information, including 
personal data, when exercising its mission and can adopt decisions binding on the intelligence services. 
The EDPB will also consider whether there is a judicial remedy against this authority’s decisions or 
inaction. 


The EDPB remains committed to playing a constructive part in securing a transatlantic transfer of 
personal data that benefits EEA individuals and organisations. The EDPB stands ready to provide the 
European Commission with support to help it build, together with the U.S., a new framework that fully 
complies with EU data protection law. 


For the European Data Protection Board 


The Chair 


(Andrea Jelinek) 
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